VIRGINIA DEPARTMENT OF

EMERGENCY MANAGEMENT

REPORT ON AUDIT

FOR THE PERIOD

JULY 1, 2013 THROUGH JANUARY 31, 2016

Auditor of Public Accounts Martha S. Mavredes, CPA www.apa.virginia.gov

(804) 225-3350

AUDIT SUMMARY

Our audit of the Department of Emergency Management (Emergency Management) for the period July 1, 2013, through January 31, 2016, found:

Proper recording and reporting of all transactions, in all material respects, in the Commonwealth Accounting and Reporting System (CARS);

Four matters involving internal control and its operation necessary to bring to management’s attention;

Two instances of non-compliance with applicable laws and regulations or other matters that are required to be reported; and

Emergency Management took appropriate corrective action to resolve all findings reported in our previous report.

Emergency Management implemented Cardinal, the Commonwealth’s new accounting and

financial reporting system, on February 1, 2016. With Emergency Management’s transition to Cardinal, the audit period for fiscal year 2016 covered only the period of July 1, 2015, through January 31, 2016.

In May 2014, the Governor appointed a new State Coordinator and Deputy State Coordinator.

Since then, management has evaluated and revised its organizational structure in an effort to become more effective and efficient. Management has also recently filled several of vacancies and intends on using the additional resources to complete its outstanding commitments. While this report includes several internal control and compliance findings, the severity and scope of the current findings is less than in our previous audits; and we observed overall improvements in the fiscal functions. We encourage management to continue to monitor its resource levels to ensure it maintains proper internal control and compliance.

 

– T A B L E   O F   C O N T E N T S – Pages 

 AUDIT SUMMARY   STATUS OF INFORMATION TECHNOLOGY TRANSFORMATION  1   AUDIT FINDINGS AND RECOMMENDATIONS  2‐4   AGENCY BACKGROUND AND FINANCIAL INFORMATION  5‐6   INDEPENDENT AUDITOR’S REPORT  7‐8   APPENDIX A – Summary of Authorizations, Appropriations, and Expenses for Active Disasters   9   AGENCY RESPONSE  10‐12   AGENCY OFFICIALS  13 

1 Period July 1, 2013 – January 31, 2016

STATUS OF INFORMATION TECHNOLOGY TRANSFORMATION

As of July 2016, Emergency Management continues to work with the Commonwealth’s

Information Technology Infrastructure Partnership and Northrup Grumman (IT Partnership) to reach a solution that meets Emergency Management’s high availability and unique systems requirements. As the two entities work towards a solution, the Commonwealth is paying an additional $38,500 per month to the IT Partnership to support “legacy assets” in addition to Emergency Management’s regular monthly service fees to support its non-transformed information technology environment. Legacy assets consist of network devices and components that are not included as standard service offerings. Emergency Management has incurred these additional fees since January 1, 2011. These fees have increased over the last several years as the costs to maintain legacy assets has increased. A fully transformed information technology infrastructure environment typically does not incur legacy asset fees. Over the last several years, Emergency Management and the IT Partnership have worked together to develop detailed draft work requests for the transformation solution as well as an estimated cost structure for the project. Additionally, Emergency Management engaged a third party vendor to review all transformation documents to ensure it included all of Emergency Management’s requirements and to substantiate whether the proposed solution is technically feasible and realistic. Based on the third party provider’s input, Emergency Management and the IT Partnership have made revisions to the work requests, but have not finalized when the transformation efforts will be complete. However, with less than three years remaining of the IT Partnership contract and the decision by the Commonwealth to adapt a multi-sourcing model for IT infrastructure services, Emergency Management needs to re-evaluate how to proceed with its transformation efforts. The Commonwealth is using a phased approach to disentangle services from the IT Partnership, starting in 2016 with messaging and mainframe services. It is the Commonwealth’s goal to have all IT Partnership services disentangled and available through multi-sourced contracts that offer a wider array of capabilities than previously offered by July 2019. We encourage Emergency Management to review the multi-sourced service contracts as they become available during the upcoming years and evaluate whether they can provide the necessary security safeguards to protect Emergency Management’s sensitive data and operations.

2 Period July 1, 2013 – January 31, 2016

AUDIT FINDINGS AND RECOMMENDATIONS

During the audit, we identified several internal control weaknesses and compliance issues that we believe are related to a lack of available resources. Over the last several years, Emergency Management has experienced a significant amount of turnover in its Finance Division and has not been able to fill all of the vacancies timely. As a result, Emergency Management’s leadership reallocated some of the resources in the Grants Management Office (Office) to assist the Finance Division (Finance) with its operations. However, the Office did not have additional resources to fully execute its grants management program and was unable to complete several of its grants management initiatives, resulting in some of the findings discussed below.

In May 2014, the Governor appointed a new State Coordinator and Deputy State Coordinator.

Since then, management has evaluated and revised its organizational structure in an effort to become more effective and efficient. As part of its re-organization, Emergency Management appointed a Deputy Coordinator to oversee its mission support or administrative functions and is making efforts to centralize its grants management function. Further, Emergency Management recently filled several of its vacancies and intends on using those additional resources to complete its outstanding grants management commitments. Emergency Management’s leadership should continue to monitor its resource levels to ensure it maintains proper internal control and compliance.

Strengthen Internal Controls over Time and Effort Reporting for Federal Grants Type of Finding: Internal Control and Compliance

Emergency Management needs to strengthen internal controls over time and effort reporting for federal grants to ensure salary charges accurately reflect the work performed by its employees. Emergency Management receives a significant portion of its funding from the federal government in the form of grants, and uses a portion of these funds to support payroll costs. Emergency Management currently estimates how much of an employee’s salary will be supported with federal funds, but does not perform subsequent reviews to confirm the estimates are consistent with the work performed by the employee. Emergency Management has been unable to perform after-the-fact reviews of the estimates because it has lacked the resources necessary to perform the reviews.

Code of Federal Regulations, 2 CFR §200.430(I) (ii), requires the records supporting charges

to federal awards be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Further, 2 CFR §200.430(I)(viii) requires the entity's system of internal control include processes to review after-the-fact interim charges made to a federal awards based on budget estimates and make adjustments to the final amounts charged to the federal award Without performing after-the-fact reviews of budget estimates, Emergency Management cannot provide these reasonable assurances.

Emergency Management should evaluate its practices to determine which method is best for

satisfying the time and effort reporting requirements for federal grants. In February 2016, Emergency Management implemented an automated solution to capture time, attendance, and leave usage. Emergency Management should determine whether it can use this solution to support

3 Period July 1, 2013 – January 31, 2016

payroll charges to federal grants. If Emergency Management continues to use budget estimates, it should perform routine after-the fact reviews to confirm budget estimates are consistent with the work performed by its employees and make adjustments when necessary. Issue Management Decisions on Sub-Grantee Single Audit Findings Type of Finding: Internal Control and Compliance

Emergency Management is not reviewing sub-grantee Single Audit reports and as a result is not issuing management decisions on audit findings in a timely manner. During the 2013 Single Audit cycle, three sub-grantees had findings related to federal awards passed through from Emergency Management. Emergency Management did not issue management decisions on sub-grantee Single Audit findings because it lacked the resources to conduct the audit report reviews and perform follow-up procedures.

Management decisions are the pass-through entities evaluation of the sub-grantee’s audit findings and corrective action plan and include the issuance of a written decision to the sub-grantee as to what corrective action is necessary. Code of Federal Regulations, 2 CFR §200.331(d), requires the pass-through entity to review financial and performance audit reports, issue a management decision(s) for audit findings pertaining to the Federal award(s) provided to sub-grantees, and follow up on the sub-grantee’s corrective action. Without reviewing the Single Audit reports and issuing management decisions, Emergency Management cannot provide assurance that its sub-grantees are taking timely corrective action on its audit findings.

Emergency Management recently hired several grants management personnel to assist with monitoring efforts. As part of these efforts, the newly hired grants management personnel will follow up on sub-grantee Single Audit findings from the last several years to confirm the sub-grantee has taken sufficient corrective action to address the findings. Going forward, Emergency Management should issue management decisions in a timely manner and use information from the Federal Audit Clearinghouse to confirm that it has issued management decisions on all sub-grantee Single Audit findings. Complete Sub-Grantee Risk Assessments in a Timely Manner Type of Finding: Internal Control

The Office is not completing sub-grantee risk assessments in a timely manner for its preparedness grants. During the audit period, the Office experienced turnover and assumed additional responsibilities due to staffing vacancies in Finance. As a result, the Office was unable to conduct risk assessments for the past several annual grant cycles or perform on-site monitoring reviews as required by its grants monitoring policy and procedure.

The Office’s policies and procedures require grant administrators to complete risk assessments for its sub-grantees on an annual basis. Between July 2013 and January 2016, Emergency Management disbursed federal monies to over 130 recipients from seven different preparedness grants. Without conducting sub-grantee risk assessments in a timely manner, the Office is unable to determine the extent of sub-grantee monitoring procedures. Additionally, the

4 Period July 1, 2013 – January 31, 2016

Office is unable to substantiate whether it monitored the sub-grantee’s activities as necessary to ensure that they complied with federal and state regulations.

Emergency Management recently hired several individuals to fill the vacancies in the Office. The Grants Director plans to use the additional resources to complete the outstanding risk assessments and conduct on-site monitoring reviews, where necessary. Emergency Management’s leadership should continue to monitor the Offices’ resource levels to ensure it is sufficient to keep pace with the required workload.

Strengthen Internal Controls over Agency Transaction Vouchers Type of Finding: Internal Control

Emergency Management needs to strengthen internal controls over agency transaction vouchers. Of 25 agency transaction vouchers reviewed during the audit, Emergency Management coded two of the vouchers to the wrong general ledger account. Emergency Management subsequently detected and corrected one of the errors; however, they did not detect or correct the other agency transaction voucher. Additionally, insufficient review by agency staff of agency transaction vouchers resulted in errors that then required processing additional agency transaction vouchers to correct those errors. Lastly, Finance experienced turnover in key positions and did not update its procedures to include detailed instructions for processing agency transaction vouchers.

Emergency Management primarily uses agency transaction vouchers for grant accounting,

correcting account coding, and moving revenues and expenditures between funds. Although Emergency Management has documented procedures, the procedures did not include detailed information on how to properly code an agency transaction voucher. Without detailed procedures, Emergency Management is at risk of misstating the information recorded in CARS.

In February 2016, Emergency Management implemented the Commonwealth’s Cardinal

system, which replaced CARS. Cardinal does not include transaction codes that automatically debit and credit the associated general ledger accounts and as a result, agency staff are now required to determine which general ledger accounts the transaction impacts. With the transition to the new system, it is important that Emergency Management update procedures to include more detailed guidance and provide training on how to code agency transaction vouchers. Additionally, Finance’s management should provide more oversight over agency transaction vouchers to ensure proper coding. By doing such, Emergency Management will be able to provide assurance that the information recorded in Cardinal is accurate.

5 Period July 1, 2013 – January 31, 2016

AGENCY BACKGROUND AND FINANCIAL INFORMATION

Emergency Management’s mission is to protect the lives and property of Virginia’s citizens and visitors from emergencies and disasters by coordinating the State’s emergency preparedness, mitigation, response, and recovery efforts. In its efforts, Emergency Management works with local governments, state and federal agencies, and voluntary organizations to provide resources and expertise. Financial Information Emergency Management’s primary source of funding is federal grants as shown in Chart 1 with over 70 percent of funds coming from the Federal Fund. Emergency Management receives federal funding for presidentially declared disaster response activities, as well as homeland security and hazard mitigation projects. They also receive General Fund appropriations which they use to match federal funds in presidentially declared disasters, and to provide assistance for disasters declared by the Governor that are not large enough to qualify for federal assistance.

Appropriations by Fund for Fiscal Year 2014 and 2015

Chart 1

Source: CARS

The Department of Planning and Budget (Planning and Budget) approves General Fund appropriations, or sum sufficient appropriations, based on authorizations by the Governor in the event of a disaster. Appendix A shows active disasters as of June 30, 2015, including amounts authorized by the Governor for each disaster, the appropriation set by Planning and Budget and the corresponding expenses by year.

$56,143,828 $54,711,168

$12,072,552 $13,424,728

$4,758,765 $5,087,220

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

2014 2015

Per

cen

t o

f To

tal A

pp

rop

riat

ion

Fiscal Year

Federal Fund General Fund Other Funds

6 Period July 1, 2013 – January 31, 2016

Emergency Management spends the majority of its funds on transfer or pass-through payments to sub-grantees, as shown in Chart 2. The majority of sub-grantees are local governments; however, Emergency Management also provides funding to other State agencies and non-governmental organizations. Sub-grantees use these funds to support their disaster recovery, hazard mitigation, and/or homeland security initiatives. As a condition to accepting grant awards from the federal government, Emergency Management is responsible for overseeing or monitoring its sub-grantees to ensure they comply with applicable laws and regulations.

Expenses by Type for Fiscal Year 2014 and 2015

Chart 2

Source: CARS

$45,666,786 $46,193,581

$11,539,026 $11,164,000

$10,315,485 $10,045,922

$1,710,330 $2,374,233

$-

$10,000,000

$20,000,000

$30,000,000

$40,000,000

$50,000,000

$60,000,000

$70,000,000

$80,000,000

2014 2015

Fiscal Year

Transfer Payments Contracts Payroll Other

7 Period July 1, 2013 – January 31, 2016

August 1, 2016 The Honorable Terence R. McAuliffe Governor of Virginia The Honorable Robert D. Orrock, Sr. Chairman, Joint Legislative Audit and Review Commission

We have audited the financial records and operations of the Department of Emergency Management (Emergency Management) for the period of July 1, 2013, through January 31, 2016. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Audit Objectives

Our audit’s primary objectives were to evaluate the accuracy of recorded financial transactions in the Commonwealth Accounting and Reporting System, review the adequacy of the Emergency Management’s internal controls, test compliance with applicable laws, regulations, contracts, and grant agreements, and review corrective actions of audit findings from prior year reports.

Audit Scope and Methodology Emergency Management’s management has responsibility for establishing and maintaining internal control and complying with applicable laws, regulations, contracts, and grant agreements. Internal control is a process designed to provide reasonable, but not absolute, assurance regarding the reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws, regulations, contracts, and grant agreements.

We gained an understanding of the overall internal controls, both automated and manual, sufficient to plan the audit. We considered significance and risk in determining the nature and extent of our audit procedures. Our review encompassed controls over the following significant cycles, classes of transactions, and account balances.

8 Period July 1, 2013 – January 31, 2016

Cash receipting Contract procurement Expenses – payroll and transfer payments Fuel charge cards Grants management Information system security Petty cash Small purchase charge cards

We performed audit tests to determine whether Emergency Management’s controls were adequate, had been placed in operation, and were being followed. Our audit also included tests of compliance with provisions of applicable laws, regulations, contracts, and grant agreements. Our audit procedures included inquiries of appropriate personnel, inspection of documents, records, and contracts, and observation of the Emergency Management’s operations. We tested transactions and performed analytical procedures, including budgetary and trend analyses.

Conclusions

We found that Emergency Management properly stated, in all material respects, the amounts recorded and reported in the Commonwealth Accounting and Reporting System. Emergency Management records its financial transactions on the cash basis of accounting, which is a comprehensive basis of accounting other than accounting principles generally accepted in the United States of America. The financial information presented in this report came directly from the Commonwealth Accounting and Reporting System.

We noted certain matters involving internal control and its operation and compliance with applicable laws, regulations, contracts and grant agreements that require management’s attention and corrective action. These matters are described in the section entitled “Audit Findings and Recommendations.”

Emergency Management has taken adequate corrective action with respect to audit findings reported in the prior year.

Exit Conference and Report Distribution

We discussed this report with management on October 26, 2016. Management’s response to the findings identified in our audit is included in the section titled “Agency Response.” We did not audit management’s response and, accordingly, we express no opinion on it.

This report is intended for the information and use of the Governor and General Assembly, management, and the citizens of the Commonwealth of Virginia and is a public record.

AUDITOR OF PUBLIC ACCOUNTS LCW/alh

APPENDIX A

9 Period July 1, 2013 – January 31, 2016

Summary of Authorizations, Appropriations, and Expenses for Active Disasters

Disaster Name Year Authorized

Amount Amount

Appropriated

Expenses (by Fiscal Year)

2013 and Prior 2014 2015 Total

November Rains 2009 $ 2,693,126 $ 2,693,126 $ 2,584,775 $ 51,203 $ 22,615 $ 2,658,593

December Snow 2009 7,511,725 3,781,183 3,052,083 412,963 388,340 3,853,386

January Snow 2010 168,349 168,349 49,959 50,040 68,350 168,349

February Snow 2010 5,867,063 3,973,282 2,724,426 1,031,050 350,740 4,106,216

Hurricane Earl 2010 100,000 86,423 18,354 68,069 - 86,423

December Snow 2010 110,798 110,769 40,210 59,790 10,769 110,769

April Events 2011 6,670,333 2,300,000 1,553,996 124,217 90,480 1,768,693 Governors Donation

Program for April Events 2011 600,000 300,000 - - - -

Hurricane Irene 2011 14,442,062 10,095,100 7,308,647 1,717,121 857,390 9,883,158

August Earthquake 2011 10,187,268 6,204,829 1,212,170 1,656,712 4,447,711 7,316,592

September Rains /Flood 2011 1,453,360 400,000 139,233 93,307 29,143 261,683

June Storm Derecho 2012 4,396,308 2,550,000 1,433,283 866,959 118,512 2,418,754

Hurricane Sandy 2012 3,013,818 1,500,000 679,324 378,034 392,240 1,449,598

March Snow 2013 500,000 200,000 14,374 119,916 1,867 136,157

February Winter Storm 2014 300,000 206,272 - 22,044 184,227 206,271

March Winter Storm 2014 250,000 38,375 - 5,852 32,771 38,623

Winter Storm/Snow/Flood 2015 450,000 - - - 100,917 100,917

Total

$58,714,210 $34,607,708 $20,810,835 $6,657,278 $7,096,070 $34,564,182 Source: Department of Emergency Management Sum Sufficient Schedule as of June 30, 2015

 

  10Period July 1, 2013 – January 31, 2016 

 

  11Period July 1, 2013 – January 31, 2016 

 

  12Period July 1, 2013 – January 31, 2016 

 

  13Period July 1, 2013 – January 31, 2016 

 

DEPARTMENT OF EMERGENCY MANAGEMENT As of January 31, 2016  

 Jeffrey D. Stern, Ph.D. State Coordinator 

 Curtis Brown 

Deputy State Coordinator